Thanks - it gave me a glimmer of hope. Until I tried changing $_GET['SiteID'] to $_POST['SiteID'] in the recordset. Unfortunately, it hasn't made any difference (I have changed the form from GET to POST too).
The three separate fields work fine with the original query, so I can't understand (not being a tecchie!) why the modification doesn't work.